openSUSE-SU-2026:20391-1

Описание

This update for MozillaThunderbird fixes the following issues:

Changes in MozillaThunderbird:

• Mozilla Thunderbird 140.8.1 ESR

  • Add mail.openpgp.load_untested_gpgme_version to load untested GPGME version

• Mozilla Thunderbird 140.8.0 ESR MFSA 2026-17 (boo#1258568)

  • CVE-2026-2757 (bmo#2001637) Incorrect boundary conditions in the WebRTC: Audio/Video component
  • CVE-2026-2758 (bmo#2009608) Use-after-free in the JavaScript: GC component
  • CVE-2026-2759 (bmo#2010933) Incorrect boundary conditions in the Graphics: ImageLib component
  • CVE-2026-2760 (bmo#2011062) Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
  • CVE-2026-2761 (bmo#2011063) Sandbox escape in the Graphics: WebRender component
  • CVE-2026-2762 (bmo#2011649) Integer overflow in the JavaScript: Standard Library component
  • CVE-2026-2763 (bmo#2012018) Use-after-free in the JavaScript Engine component
  • CVE-2026-2764 (bmo#2012608) JIT miscompilation, use-after-free in the JavaScript Engine: JIT component
  • CVE-2026-2765 (bmo#2013562) Use-after-free in the JavaScript Engine component
  • CVE-2026-2766 (bmo#2013583) Use-after-free in the JavaScript Engine: JIT component
  • CVE-2026-2767 (bmo#2013741) Use-after-free in the JavaScript: WebAssembly component
  • CVE-2026-2768 (bmo#2014101) Sandbox escape in the Storage: IndexedDB component
  • CVE-2026-2769 (bmo#2014550) Use-after-free in the Storage: IndexedDB component
  • CVE-2026-2770 (bmo#2014585) Use-after-free in the DOM: Bindings (WebIDL) component
  • CVE-2026-2771 (bmo#2014593) Undefined behavior in the DOM: Core & HTML component
  • CVE-2026-2772 (bmo#2014827) Use-after-free in the Audio/Video: Playback component
  • CVE-2026-2773 (bmo#2014832) Incorrect boundary conditions in the Web Audio component
  • CVE-2026-2774 (bmo#2014883) Integer overflow in the Audio/Video component
  • CVE-2026-2775 (bmo#2015199) Mitigation bypass in the DOM: HTML Parser component
  • CVE-2026-2776 (bmo#2015266) Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software
  • CVE-2026-2777 (bmo#2015305) Privilege escalation in the Messaging System component
  • CVE-2026-2778 (bmo#2016358) Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component
  • CVE-2026-2779 (bmo#1164141) Incorrect boundary conditions in the Networking: JAR component
  • CVE-2026-2780 (bmo#2007829) Privilege escalation in the Netmonitor component
  • CVE-2026-2781 (bmo#2009552) Integer overflow in the Libraries component in NSS
  • CVE-2026-2782 (bmo#2010743) Privilege escalation in the Netmonitor component
  • CVE-2026-2783 (bmo#2010943) Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component
  • CVE-2026-2784 (bmo#2012984) Mitigation bypass in the DOM: Security component
  • CVE-2026-2785 (bmo#2013549) Invalid pointer in the JavaScript Engine component
  • CVE-2026-2786 (bmo#2013612) Use-after-free in the JavaScript Engine component
  • CVE-2026-2787 (bmo#2014560) Use-after-free in the DOM: Window and Location component
  • CVE-2026-2788 (bmo#2014824) Incorrect boundary conditions in the Audio/Video: GMP component
  • CVE-2026-2789 (bmo#2015179) Use-after-free in the Graphics: ImageLib component
  • CVE-2026-2790 (bmo#2008426) Same-origin policy bypass in the Networking: JAR component
  • CVE-2026-2791 (bmo#2015220) Mitigation bypass in the Networking: Cache component
  • CVE-2026-2792 (bmo#2008912, bmo#2010050, bmo#2010275, bmo#2012331) Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
  • CVE-2026-2793 (bmo#2015196, bmo#2016423, bmo#2016498) Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148

• Mozilla Thunderbird 140.7.2 ESR MFSA 2026-11 (boo#1258231)

  • CVE-2026-2447 (bmo#2014390) Heap buffer overflow in libvpx

• Mozilla Thunderbird 140.7.1 ESR MFSA 2026-08 (bsc#1257397)

  • CVE-2026-0818 (bmo#1881530) CSS-based exfiltration of the content from partially encrypted emails when allowing remote content

• Support using system GnuPG with gpgme 2, boo#1253718

• Mozilla Thunderbird 140.7.0 ESR MFSA 2026-05 (bsc#1256340)

  • CVE-2026-0877 (bmo#1999257) Mitigation bypass in the DOM: Security component
  • CVE-2026-0878 (bmo#2003989) Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • CVE-2026-0879 (bmo#2004602) Sandbox escape due to incorrect boundary conditions in the Graphics component
  • CVE-2026-0880 (bmo#2005014) Sandbox escape due to integer overflow in the Graphics component
  • CVE-2026-0882 (bmo#1924125) Use-after-free in the IPC component
  • CVE-2025-14327 (bmo#1970743) Spoofing issue in the Downloads Panel component
  • CVE-2026-0883 (bmo#1989340) Information disclosure in the Networking component
  • CVE-2026-0884 (bmo#2003588) Use-after-free in the JavaScript Engine component
  • CVE-2026-0885 (bmo#2003607) Use-after-free in the JavaScript: GC component
  • CVE-2026-0886 (bmo#2005658) Incorrect boundary conditions in the Graphics component
  • CVE-2026-0887 (bmo#2006500) Clickjacking issue, information disclosure in the PDF Viewer component
  • CVE-2026-0890 (bmo#2005081) Spoofing issue in the DOM: Copy & Paste and Drag & Drop component
  • CVE-2026-0891 (bmo#1964722, bmo#2000981, bmo#2003100, bmo#2003278) Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147